@anonympins/fingerprint 0.5.2 → 0.5.5

package/src/php/Challenge/ChallengeUtils.php

@@ -839,6 +839,7 @@ class ChallengeUtils
 
         $solverCode = self::getPowSolverCode();
         $queriesJson = json_encode($queries);
+        $coopTimeout = $securityConfig['pospace']['coopTimeout'] ?? 15;
 
         $safePath = json_encode($path, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_UNESCAPED_SLASHES);
         $safeNonce = json_encode($nonce, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_UNESCAPED_SLASHES);
@@ -854,6 +855,7 @@ class ChallengeUtils
             const nodeId = "{$nodeId}";
             const peerId = "{$peerId}";
             const peerBlockIdx = {$peerBlockIdx};
+            const coopTimeout = {$coopTimeout};
             
             document.getElementById('loader').innerText = '⚙️ Checking persistent local storage...';
             await new Promise(r => setTimeout(r, 10));
@@ -889,7 +891,7 @@ class ChallengeUtils
                     await fetch(window.location.pathname + "?coop_op=request_peer_block&node_id=" + nodeId + "&peer_id=" + peerId + "&block_idx=" + peerBlockIdx + "&req_id=" + reqId);
                     
                     let attempts = 0;
-                    while (attempts < 15) {
+                    while (attempts < coopTimeout) {
                         const res = await fetch(window.location.pathname + "?coop_op=poll_response&node_id=" + nodeId + "&req_id=" + reqId);
                         const data = await res.json();
                         if (data.status === 'ready') {
@@ -944,12 +946,23 @@ JS;
         $baseBlock = self::createCpuChallengeBaseBlock($nonce, $clientSecret, $originalFingerprint);
         $baseBlockBytes = '[' . implode(',', array_values(unpack('C*', $baseBlock))) . ']';
 
-        $trapLinksHtml = implode(' ', array_map(
-            fn($url, $index) => "<a href=\"{$url}\" tabindex=\"-1\"><span>&gt; " . ($index + 1) . "</span></a>",
-            $trapUrls,
-            array_keys($trapUrls)
-        ));
-        $trapContainerHtml = "<div style=\"position:absolute;left:-9999px;top:-9999px;transform:scale(0);pointer-events:none;\" aria-hidden=\"true\">{$trapLinksHtml}</div>";
+        $trapTags = ['div', 'span', 'p', 'section'];
+        $selectedTrapTag = $trapTags[array_rand($trapTags)];
+        $layoutProps = [
+            'position:absolute;left:-9999px;top:-9999px;transform:scale(0);pointer-events:none;',
+            'position:fixed;left:-8888px;top:-8888px;opacity:0;pointer-events:none;width:0;height:0;overflow:hidden;',
+            'display:none;visibility:hidden;pointer-events:none;'
+        ];
+        $selectedLayout = $layoutProps[array_rand($layoutProps)];
+
+        $trapLinks = [];
+        foreach ($trapUrls as $index => $url) {
+            $nestingType = rand(0, 2);
+            $innerHtml = ($nestingType === 1) ? "<b>&gt; " . ($index + 1) . "</b>" : (($nestingType === 2) ? "<i>&gt; " . ($index + 1) . "</i>" : "<span>&gt; " . ($index + 1) . "</span>");
+            $trapLinks[] = "<a href=\"{$url}\" tabindex=\"-1\">{$innerHtml}</a>";
+        }
+        $trapLinksHtml = implode(' ', $trapLinks);
+        $trapContainerHtml = "<{$selectedTrapTag} style=\"{$selectedLayout}\" aria-hidden=\"true\">{$trapLinksHtml}</{$selectedTrapTag}>";
 
         $safePath = json_encode($path, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_UNESCAPED_SLASHES);
         $safeNonce = json_encode($nonce, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_UNESCAPED_SLASHES);
@@ -980,7 +993,7 @@ JS;
                 return;
             }
 
-            const finalUrl = path + "?pow_type=cpu_mem&pow_nonce=" + nonce + "&pow_solution_cpu=" + cpuSolution + "&pow_solution_mem=" + memSolution;
+        const finalUrl = path + "?pow_type=cpu_mem&pow_nonce=" + nonce + "&pow_solution_cpu=" + cpuSolution + "&pow_solution_mem=" + encodeURIComponent(JSON.stringify(memSolution));
             window.location.href = finalUrl;
           }
           solve();

package/src/php/FingerprintClient.php

@@ -77,13 +77,30 @@ class FingerprintClient
             $this->clientConfig['honeypots'][] = $fieldName;
         }
 
-        // Styles CSS pour cacher le champ de manière robuste.
-        $styles = 'position:absolute; left:-9999px; top:-9999px; transform:scale(0); opacity:0; pointer-events:none;';
+        // Styles CSS polymorphiques pour cacher le champ de manière robuste.
+        $styleOptions = [
+            'position:absolute; left:-9999px; top:-9999px; transform:scale(0); opacity:0; pointer-events:none;',
+            'position:fixed; left:-8888px; top:-8888px; width:0; height:0; overflow:hidden; opacity:0; pointer-events:none;',
+            'display:none; visibility:hidden; pointer-events:none;'
+        ];
+        $styles = $styleOptions[array_rand($styleOptions)];
+
+        $containerTags = ['div', 'span', 'p', 'section'];
+        $tag = $containerTags[array_rand($containerTags)];
+
+        $nestingType = rand(0, 1);
+        if ($nestingType === 1) {
+            return '<' . $tag . ' style="' . $styles . '" aria-hidden="true">'
+                . '<label for="' . htmlspecialchars($fieldName) . '">' . htmlspecialchars($fieldName) 
+                . '<input type="text" id="' . htmlspecialchars($fieldName) . '" name="' . htmlspecialchars($fieldName) . '" tabindex="-1" autocomplete="off">'
+                . '</label>'
+                . '</' . $tag . '>';
+        }
 
-        return '<div style="' . $styles . '" aria-hidden="true">'
-            . '<label for="' . htmlspecialchars($fieldName) . '">' . $fieldName . '</label>'
+        return '<' . $tag . ' style="' . $styles . '" aria-hidden="true">'
+            . '<label for="' . htmlspecialchars($fieldName) . '">' . htmlspecialchars($fieldName) . '</label>'
             . '<input type="text" id="' . htmlspecialchars($fieldName) . '" name="' . htmlspecialchars($fieldName) . '" tabindex="-1" autocomplete="off">'
-            . '</div>';
+            . '</' . $tag . '>';
     }
 
     /**

package/src/php/FingerprintEngine.php

@@ -31,6 +31,137 @@
      private static ?array $yandexEntries = null;
      private static ?array $bingbotEntries = null;
 
+     private static array $dnsCircuitBreaker = [
+         'state' => 'CLOSED',
+         'failureCount' => 0,
+         'lastStateChange' => 0,
+         'threshold' => 5,
+         'cooldown' => 30, // seconds
+     ];
+
+     private static function recordDnsSuccess(): void
+     {
+         self::$dnsCircuitBreaker['failureCount'] = 0;
+         self::$dnsCircuitBreaker['state'] = 'CLOSED';
+     }
+
+     private static function recordDnsFailure(): void
+     {
+         self::$dnsCircuitBreaker['failureCount']++;
+         if (self::$dnsCircuitBreaker['failureCount'] >= self::$dnsCircuitBreaker['threshold']) {
+             self::$dnsCircuitBreaker['state'] = 'OPEN';
+             self::$dnsCircuitBreaker['lastStateChange'] = microtime(true);
+         }
+     }
+
+     private static function canAttemptDns(): bool
+     {
+         if (self::$dnsCircuitBreaker['state'] === 'CLOSED') {
+             return true;
+         }
+         if (self::$dnsCircuitBreaker['state'] === 'OPEN') {
+             if (microtime(true) - self::$dnsCircuitBreaker['lastStateChange'] >= self::$dnsCircuitBreaker['cooldown']) {
+                 self::$dnsCircuitBreaker['state'] = 'HALF-OPEN';
+                 return true;
+             }
+             return false;
+         }
+         return true; // HALF-OPEN
+     }
+
+     private static function getReverseDnsName(string $ip): ?string
+     {
+         if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
+             return implode('.', array_reverse(explode('.', $ip))) . '.in-addr.arpa';
+         } elseif (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
+             $hex = bin2hex((string)inet_pton($ip));
+             return implode('.', array_reverse(str_split($hex))) . '.ip6.arpa';
+         }
+         return null;
+     }
+
+     private static function dnsResolveUdp(string $query, string $type, float $timeout = 0.5): ?array
+     {
+         $dnsServer = '8.8.8.8';
+         $port = 53;
+         $fp = @stream_socket_client("udp://$dnsServer:$port", $errno, $errstr, $timeout);
+         if (!$fp) return null;
+         stream_set_timeout($fp, 0, (int)($timeout * 1000000));
+         
+         $id = rand(10000, 65000);
+         $header = pack('n6', $id, 0x0100, 1, 0, 0, 0);
+         
+         $qType = ($type === 'PTR') ? 12 : (($type === 'AAAA') ? 28 : 1);
+         $parts = explode('.', $query);
+         $qName = '';
+         foreach ($parts as $part) {
+             $qName .= chr(strlen($part)) . $part;
+         }
+         $qName .= chr(0);
+         $question = $qName . pack('n2', $qType, 1);
+         
+         if (!@fwrite($fp, $header . $question)) {
+             fclose($fp);
+             return null;
+         }
+         
+         $response = @fread($fp, 512);
+         fclose($fp);
+         if (!$response || strlen($response) < 12) return null;
+         
+         $resHeader = unpack('n6', substr($response, 0, 12));
+         if ($resHeader[1] !== $id) return null;
+         
+         $answersCount = $resHeader[4];
+         if ($answersCount <= 0) return [];
+         
+         $offset = 12 + strlen($question);
+         $results = [];
+         for ($i = 0; $i < $answersCount; $i++) {
+             if ($offset + 12 > strlen($response)) break;
+             if ((ord($response[$offset]) & 0xc0) === 0xc0) {
+                 $offset += 2;
+             } else {
+                 while ($offset < strlen($response) && ord($response[$offset]) !== 0) {
+                     $offset += 1 + ord($response[$offset]);
+                 }
+                 $offset++;
+             }
+             if ($offset + 10 > strlen($response)) break;
+             $typeAndClass = unpack('n2type_class/Nttl/nlen', substr($response, $offset, 10));
+             $rType = $typeAndClass['type_class1'];
+             $rLen = $typeAndClass['len'];
+             $offset += 10;
+             if ($offset + $rLen > strlen($response)) break;
+             $rData = substr($response, $offset, $rLen);
+             $offset += $rLen;
+             
+             if ($rType === 12) {
+                 $ptrName = '';
+                 $p = 0;
+                 while ($p < strlen($rData)) {
+                     $l = ord($rData[$p]);
+                     if ($l === 0) break;
+                     if (($l & 0xc0) === 0xc0) {
+                         break;
+                     }
+                     $ptrName .= substr($rData, $p + 1, $l) . '.';
+                     $p += 1 + $l;
+                 }
+                 $results[] = rtrim($ptrName, '.');
+             } elseif ($rType === 1) {
+                 if ($rLen === 4) {
+                     $results[] = long2ip(unpack('N', $rData)[1]);
+                 }
+             } elseif ($rType === 28) {
+                 if ($rLen === 16) {
+                     $results[] = inet_ntop($rData);
+                 }
+             }
+         }
+         return $results;
+     }
+
      public function __construct(array $securityConfig)
      {
          $this->isProduction = ($_ENV['APP_ENV'] ?? getenv('APP_ENV')) === 'production';
@@ -387,13 +518,19 @@
 
              $deviceId = bin2hex(random_bytes(16)); // UUID-like
 
+             $isHttps = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ||
+                 (isset($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] == 443) ||
+                 ($context->getHeader('x-forwarded-proto') === 'https');
+             $secureOption = $isHttps || $this->isProduction;
+
              // Préparer le cookie à envoyer
              $newCookie = [
                  'name' => 'device_id',
                  'value' => $deviceId,
                  'options' => [
                      'httponly' => true,
-                     'secure' => $this->isProduction,
+                     'secure' => $secureOption,
+                     'partitioned' => $secureOption,
                      'samesite' => 'Strict',
                      'path' => '/',
                  ]
@@ -852,7 +989,7 @@
                              ]);
                              if (json_last_error() === JSON_ERROR_NONE) {
                                  // @phpstan-ignore-next-line - L'instance est gérée par le singleton
-                                $defaultPath = dirname(__DIR__, 2) . '/problems.config.json';
+                            $defaultPath = dirname(__DIR__, 2) . '/config/problems.config.json';
                                 $configPath = $this->securityConfig['usefulWorkConfigPath'] ?? (file_exists($defaultPath) ? $defaultPath : null);
                                 $problemManager = \Anonympins\Fingerprint\ProblemManager::getInstance($configPath, $store);
                                  // FIX: La solution est directement le $workResult, pas une sous-propriété.
@@ -871,15 +1008,31 @@
                  if ($isValid) {
                      $store->delete("secret:{$powNonce}");
                      $ticketTtl = $this->securityConfig['ticketMaxAge'] ?? 3600000;
-                    MetricsManager::incrementCounter('challenges_solved_total');
+                     MetricsManager::incrementCounter('challenges_solved_total');
                      $this->log('Challenge solution valid - issuing ticket', ['ticketMaxAge' => $ticketTtl]);
- 
+
+                     $isHttps = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ||
+                         (isset($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] == 443) ||
+                         ($context->getHeader('x-forwarded-proto') === 'https');
+                     $secureOption = $isHttps || $this->isProduction;
+
                      return [
                          'action' => 'redirect',
                          'path' => RequestUtils::cleanUrlFromPowParams($challengeContext['originalPath'] ?? '/', $context->query),
                          'score' => 0.0,
                          'vector' => ['challenge_solved' => 100],
-                         'cookie' => ['name' => 'pow_clearance', 'value' => $ticket, 'options' => ['httponly' => true, 'secure' => $this->isProduction, 'expires' => time() + ($ticketTtl / 1000), 'path' => '/']]
+                         'cookie' => [
+                             'name' => 'pow_clearance',
+                             'value' => $ticket,
+                             'options' => [
+                                 'httponly' => true,
+                                 'secure' => $secureOption,
+                                 'samesite' => 'Strict',
+                                 'expires' => time() + ($ticketTtl / 1000),
+                                 'path' => '/',
+                                 'partitioned' => $secureOption,
+                             ]
+                         ]
                      ];
                  }
              }
@@ -888,7 +1041,7 @@
              $this->log('Challenge solution invalid or context expired', ['nonce' => $powNonce], 'warn');
              $suspicionVector['honeypotScore'] = 100.0;
          }
- 
+
          // 3. Vérifier un ticket existant
          $hasValidTicket = false;
          $powCookie = $context->cookies['pow_clearance'] ?? null;
@@ -903,7 +1056,7 @@
              // $this->log('Valid clearance ticket found');
              // return ['action' => 'next', 'score' => 0.0, 'vector' => ['ticket_valid' => 100]];
          }
- 
+
          // 4. Calculer le vecteur et le score de suspicion
          // Résoudre l'identité et vérifier le statut "condamné"
          $store = StoreManager::getStore();
@@ -934,7 +1087,7 @@
             RequestUtils::updateSubnetMetrics($context, $deviceId, $finalScore);
             MetricsManager::observeValue('suspicion_score', $finalScore, ['action' => 'high_score_subnet_update']);
          }
- 
+
          // Logique pour challenger les nouveaux appareils (déplacée ici pour avoir le score final)
          $isNewDevice = $identity['newCookie'] !== null;
          if ($isNewDevice && ($this->securityConfig['challengeNewDevices'] ?? false) && $finalScore < $thresholds['low']) {
@@ -944,7 +1097,7 @@
              ]);
              $finalScore = (float)$thresholds['low'];
          }
- 
+
          // Vérifier les URL pièges (après calcul du score)
          $lastNonce = $deviceData['lastChallengeNonce'] ?? null;
          if ($lastNonce && ChallengeUtils::verifyTrapUrl($context->path, $context->query['sig'] ?? '', $lastNonce)) {
@@ -963,7 +1116,7 @@
              }
              return $decision;
          }
- 
+
          // 5. Prendre une décision basée sur le score - Vérifier le blocage d'abord.
          $blockThreshold = $thresholds['block'] ?? 95;
          if ($finalScore >= $blockThreshold) {
@@ -1000,14 +1153,14 @@
              }
 
              $highThreshold = $thresholds['high'] ?? 75;
-             $mustReChallenge = $finalScore >= $highThreshold && $hasValidTicket;
- 
+             $mustReChallenge = $finalScore >= $highThreshold && $hasValidTicket && $finalScore > 0;
+
              $lowThreshold = $thresholds['low'] ?? 20;
              if (($finalScore >= $lowThreshold && !$hasValidTicket) || $mustReChallenge) {
                  if ($mustReChallenge) {
                      $this->log('High suspicion score detected - overriding valid ticket to re-issue challenge', ['finalScore' => $finalScore, 'deviceId' => $deviceId]);
                  }
- 
+
                  // --- AJOUT: Limiteur de débit (Token Bucket) ---
                  $rateLimitPassed = ChallengeUtils::checkChallengeRateLimit($context->clientIp);
                  if (!$rateLimitPassed) {
@@ -1027,9 +1180,9 @@
                      }
                      return $decision;
                  }
- 
+
                  $decision = ['action' => 'challenge', 'score' => $finalScore, 'vector' => $suspicionVector, 'status' => 403];
- 
+
                  if ($this->dryRun) {
                     MetricsManager::incrementCounter('requests_total', ['status' => 'dry_run_challenge']);
                      $this->log("[Dry Run] Intended action: {$decision['action']}", ['score' => $decision['score']]);
@@ -1038,10 +1191,10 @@
                      unset($decision['status']);
                      return $decision;
                  }
- 
+
                 MetricsManager::incrementCounter('requests_total', ['status' => 'challenged']);
                  $this->log('Suspicious request - selecting challenge type', ['finalScore' => $finalScore]);
- 
+
                  $nonce = bin2hex(random_bytes(16));
                  $clientSecret = bin2hex(random_bytes(16));
                  $highThreshold = $thresholds['high'] ?? 75;
@@ -1062,7 +1215,7 @@
 
                  if ($shouldUseUsefulWork) {
                      $this->log('Issuing a useful work challenge', ['finalScore' => $finalScore]);
-                    $defaultPath = dirname(__DIR__, 2) . '/problems.config.json';
+                    $defaultPath = dirname(__DIR__, 2) . '/config/problems.config.json';
                     $configPath = $this->securityConfig['usefulWorkConfigPath'] ?? (file_exists($defaultPath) ? $defaultPath : null);
                     $problemManager = ProblemManager::getInstance($configPath, $store);
                      $work = $problemManager->dispatchWork($finalScore);
@@ -1143,10 +1296,10 @@
                  // Alignement linéaire parfait du ratio d'effort CPU/Mémoire
                  $memActivationFactor = $suspicionFactor;
                  $memDifficulty = (int)round($memActivationFactor * 48); // 0 à 48MB
- 
+
                  $originalFingerprint = RequestUtils::getCompositeDeviceHash($context);
                  $baseBlock = ChallengeUtils::createCpuChallengeBaseBlock($nonce, $clientSecret, $originalFingerprint);
- 
+
                  $challengeContext = [
                      'clientSecret' => $clientSecret,
                      'cpuTarget' => $cpuChallengeDetails['target'],
@@ -1156,22 +1309,22 @@
                      'baseBlock' => $baseBlock,
                      'originalPath' => $context->path,
                  ];
- 
+
                  $store->set("secret:{$nonce}", $challengeContext, $this->securityConfig['challengeTtl'] ?? 300);
- 
+
                  // Associer le nonce au device pour la vérification des URL pièges
                  if ($deviceData) {
                      $deviceData['lastChallengeNonce'] = $nonce;
                      $store->set("device:{$deviceId}", $deviceData); // @phpstan-ignore-line
                  }
- 
+
                  $trapUrls = [ChallengeUtils::generateTrapUrl($nonce), ChallengeUtils::generateTrapUrl($nonce)];
                  $this->log('Challenge issued', ['nonce' => $nonce, 'ttl' => $this->securityConfig['challengeTtl'] ?? 300]);
- 
+
                  if ($this->logger) {
                      $this->logger->log('info', 'challenge_issued', ['deviceId' => $deviceId, 'score' => $finalScore, 'vector' => $suspicionVector]);
                  }
- 
+
                  // Pour les API, retourner un challenge JSON
                  if ($isApiRequest) {
                      $challengePayload = [
@@ -1188,7 +1341,7 @@
                  } else {
                      // Pour les navigateurs, retourner une page HTML
                      $pageBody = ChallengeUtils::generateCombinedPoWChallengePage(
-                         $cpuChallengeDetails, $memDifficulty, $clientSecret, 
+                         $cpuChallengeDetails, $memDifficulty, $clientSecret,
                          $this->securityConfig, $trapUrls, $originalFingerprint
                      );
                      $decision['body'] = $pageBody;
@@ -1210,12 +1363,12 @@
                  $response = ['action' => 'next', 'score' => $finalScore, 'vector' => $suspicionVector, 'intendedAction' => 'next'];
              }
          }
- 
+
          // Si un nouveau cookie d'identification a été généré, on l'ajoute à la réponse.
          if (isset($context->newCookieForResponse)) {
              $response['newCookieForResponse'] = $context->newCookieForResponse;
          }
- 
+
          return $response;
      }
 
@@ -1227,7 +1380,7 @@
          if (empty($operationType) || empty($operationName)) {
              return false;
          }
- 
+
          $whitelistRules = $this->securityConfig['whitelist'] ?? [];
          $graphqlRule = null;
          foreach ($whitelistRules as $rule) {
@@ -1236,23 +1389,23 @@
                  break;
              }
          }
- 
+
          if (empty($graphqlRule['entries'])) {
              return false;
          }
- 
+
          foreach ($graphqlRule['entries'] as $entry) {
              [$entryType, $entryName] = explode(':', $entry, 2);
              if ($entryType !== $operationType) continue;
- 
+
              if ($entryName === $operationName || $entryName === '*') return true;
- 
+
              if (str_ends_with($entryName, '*') && str_starts_with($operationName, substr($entryName, 0, -1))) return true;
          }
- 
+
          return false;
      }
- 
+
      /**
       * Vérifie si une requête provient d'un bot légitime et whitelisté (ex: Googlebot)
       * en utilisant des recherches DNS inversées et directes. Le résultat est mis en cache.
@@ -1284,44 +1437,67 @@
          if ($cachedStatus === 'verified') return true;
          if ($cachedStatus === 'failed') return false;
 
+         if (!self::canAttemptDns()) {
+             return false;
+         }
+
          try {
-             // 1. Reverse DNS lookup. gethostbyaddr peut être lent, mais c'est la méthode standard.
-             // @ pour supprimer les warnings si l'IP n'a pas de PTR record.
-             $hostname = @gethostbyaddr($context->clientIp);
-             if ($hostname === false || $hostname === $context->clientIp) {
-                 $store->set($cacheKey, 'failed', 86400);
+             // 1. Reverse DNS lookup with strict 500ms timeout using our custom UDP DNS Client
+             $revName = self::getReverseDnsName($context->client_ip);
+             if (!$revName) {
+                 $store->set($cacheKey, 'failed', 300); // 5 min negative caching
+                 return false;
+             }
+             $hostnames = self::dnsResolveUdp($revName, 'PTR', 0.5);
+             if ($hostnames === null || empty($hostnames)) {
+                 self::recordDnsFailure();
+                 $store->set($cacheKey, 'failed', 300); // 5 min negative caching
                  return false;
              }
 
              $validHostname = null;
-             if (str_ends_with($hostname, $matchedRule['hostnameSuffix'])) {
-                 $validHostname = $hostname;
+             foreach ($hostnames as $hostname) {
+                 if (str_ends_with($hostname, $matchedRule['hostnameSuffix'])) {
+                     $validHostname = $hostname;
+                     break;
+                 }
              }
 
              if ($validHostname === null) {
-                 $store->set($cacheKey, 'failed', 86400);
+                 $store->set($cacheKey, 'failed', 300); // 5 min negative caching
                  return false;
              }
- 
-             // 2. Forward DNS lookup
-             $addresses = array_merge(dns_get_record($validHostname, DNS_A) ?: [], dns_get_record($validHostname, DNS_AAAA) ?: []);
+
+             // 2. Forward DNS lookup with strict 500ms timeout
              $ips = [];
-             foreach ($addresses as $address) {
-                 if (isset($address['ip'])) {
-                     $ips[] = $address['ip'];
-                 }
-                 if (isset($address['ipv6'])) {
-                     $ips[] = $address['ipv6'];
-                 }
+             $resolvedA = self::dnsResolveUdp($validHostname, 'A', 0.5);
+             if ($resolvedA === null) {
+                 self::recordDnsFailure();
+                 $store->set($cacheKey, 'failed', 300); // 5 min negative caching
+                 return false;
              }
- 
-             if (in_array($context->clientIp, $ips, true)) {
+             $ips = array_merge($ips, $resolvedA);
+
+             $resolvedAaaa = self::dnsResolveUdp($validHostname, 'AAAA', 0.5);
+             if ($resolvedAaaa === null) {
+                 self::recordDnsFailure();
+                 $store->set($cacheKey, 'failed', 300); // 5 min negative caching
+                 return false;
+             }
+             $ips = array_merge($ips, $resolvedAaaa);
+
+             if (in_array($context->client_ip, $ips, true)) {
+                 self::recordDnsSuccess();
                  $store->set($cacheKey, 'verified', 86400);
                  return true;
              }
-         } catch (\Exception $e) { /* DNS errors */ }
+         } catch (\Exception $e) {
+             self::recordDnsFailure();
+             $store->set($cacheKey, 'failed', 300); // 5 min negative caching
+             return false;
+         }
 
-         $store->set($cacheKey, 'failed', 86400);
+         $store->set($cacheKey, 'failed', 300); // 5 min negative caching
          return false;
      }
 

package/src/php/Optimization/Optimization.php

@@ -224,31 +224,38 @@ class Optimization
      */
     public static function benfordTest(array $numbers): float // Rendre la méthode publique et statique
     {
-        if (count($numbers) < 10) {
-            return 0.0; // Pas assez de données
-        }
-
-        $leadingDigits = array_map(function ($n) {
-            $str = ltrim((string)$n, '0.');
-            return $str[0] ?? '';
-        }, $numbers);
-
-        $leadingDigits = array_filter($leadingDigits, fn ($d) => $d >= '1' && $d <= '9');
+        $counts = array_fill(1, 9, 0);
+        $validCount = 0;
 
-        if (count($leadingDigits) < 10) {
-            return 0.0;
+        foreach ($numbers as $n) {
+            if (is_string($n)) {
+                $n = (float)$n;
+            }
+            if (!is_numeric($n)) {
+                continue;
+            }
+            $val = abs((float)$n);
+            if ($val == 0.0) {
+                continue;
+            }
+            $log = log10($val);
+            $factor = pow(10, (int)floor($log));
+            $digit = (int)floor($val / $factor);
+            if ($digit >= 1 && $digit <= 9) {
+                $counts[$digit]++;
+                $validCount++;
+            }
         }
 
-        $counts = array_fill(1, 9, 0);
-        foreach ($leadingDigits as $digit) {
-            $counts[(int)$digit]++;
+        if ($validCount < 10) {
+            return 0.0;
         }
 
         $benfordDistribution = [1 => 30.1, 2 => 17.6, 3 => 12.5, 4 => 9.7, 5 => 7.9, 6 => 6.7, 7 => 5.8, 8 => 5.1, 9 => 4.6];
 
         $totalDeviation = 0.0;
         for ($i = 1; $i <= 9; $i++) {
-            $observedFrequency = ($counts[$i] / count($leadingDigits)) * 100;
+            $observedFrequency = ($counts[$i] / $validCount) * 100.0;
             $expectedFrequency = $benfordDistribution[$i];
             $totalDeviation += pow($observedFrequency - $expectedFrequency, 2);
         }